ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 881:

  A retail company is looking to start a development project that will utilize open source components in its code for the first time. The development team has already acquired several open source components and utilized them in proof of concept (POC) code. The team recognizes that the legal and operational risks are outweighed by the benefits of open-source software use. What MUST the organization do next?

  A. Mandate that all open-source components be approved by the Information Security Manager (ISM).
  B. Scan all open-source components for security vulnerabilities.
  C. Establish an open-source compliance policy.
  D. Require commercial support for all open-source components.
  C. Establish an open-source compliance policy.

• Question 882:

  Which of the following processes has the PRIMARY purpose of identifying outdated software versions, missing patches, and lapsed system updates?

  A. Penetration testing
  B. Vulnerability management
  C. Software Development Life Cycle (SDLC)
  D. Life cycle management
  B. Vulnerability management

• Question 883:

  What is the threat modeling order using process for Attack simu-lation and threat analysis (PASTA)?

  A. Application decomposition, threat analysis, vulnerability detection, attack enumeration, risk/impact analysis
  B. Threat analysis, vulnerability detection, application decomposition, attack enumeration, risk/Impact analysis
  C. Risk/impact analysis, application decomposition, threat analysis, vulnerability detection, attack enumeration
  D. Application decomposition, threat analysis, risk/impact analysis, vulnerability detection, attack enumeration
  A. Application decomposition, threat analysis, vulnerability detection, attack enumeration, risk/impact analysis

• Question 884:

  An organization is planning to have an it audit of its as a Service (SaaS) application to demonstrate to external parties that the security controls around availability are designed. The audit report must also cover a certain period of time to show the operational effectiveness of the controls. Which Service Organization Control (SOC) report would BEST fit their needs?

  A. SOC 1 Type 1
  B. SOC 1 Type 2
  C. SOC 2 Type 1
  D. SOC 2 Type 2
  D. SOC 2 Type 2

• Question 885:

  What is a characteristic of Secure Socket Layer (SSL) and Transport Layer Security (TLS)?

  A. SSL and TLS provide a generic channel security mechanism on top of Transmission Control Protocol (TCP).
  B. SSL and TLS provide nonrepudiation by default.
  C. SSL and TLS do not provide security for most routed protocols.
  D. SSL and TLS provide header encapsulation over HyperText Transfer Protocol (HTTP).
  A. SSL and TLS provide a generic channel security mechanism on top of Transmission Control Protocol (TCP).

• Question 886:

  The stringency of an Information Technology (IT) security assessment will be determined by the

  A. system's past security record.
  B. size of the system's database.
  C. sensitivity of the system's datA.
  D. age of the system.
  C. sensitivity of the system's datA.

• Question 887:

  Access to which of the following is required to validate web session management?

  A. Log timestamp
  B. Live session traffic
  C. Session state variables
  D. Test scripts
  B. Live session traffic

• Question 888:

  Which of the following security testing strategies is BEST suited for companies with low to moderate security maturity?

  A. Load Testing
  B. White-box testing
  C. Black -box testing
  D. Performance testing
  B. White-box testing

• Question 889:

  A hospital has allowed virtual private networking (VPN) access to remote database developers. Upon auditing the internal firewall configuration, the network administrator discovered that split-tunneling was enabled. What is the concern with this configuration?

  A. Remote sessions will not require multi-layer authentication.
  B. Remote clients are permitted to exchange traffic with the public and private network.
  C. Multiple Internet Protocol Security (IPSec) tunnels may be exploitable in specific circumstances.
  D. The network intrusion detection system (NIDS) will fail to inspect Secure Sockets Layer (SSL) traffic.
  B. Remote clients are permitted to exchange traffic with the public and private network.

• Question 890:

  Which of the following benefits does Role Based Access Control (RBAC) provide for the access review process?

  A. Lowers the amount of access requests after review
  B. Gives more control into the revocation phase
  C. Gives more fine-grained access analysis to accesses
  D. Lowers the number of items to be reviewed
  C. Gives more fine-grained access analysis to accesses